unity-scene-create
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a series of shell commands through the
unity-clitool to manage Unity scenes, GameObjects, and components. This includes both high-level subcommands and arawmode for low-level payload delivery via JSON-formatted arguments.- [DYNAMIC_EXECUTION]: Instructions inreferences/runtime-checklist.mdadvise the agent to usecargo run -- <args>to compile and execute the tool from source when a global binary is not available in the workspace. This involves runtime compilation of the local codebase using the Rust build system.- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect injection by accepting user-defined strings for GameObject names and component types which are interpolated into shell command arguments. - Ingestion points: User requests for creating or modifying scene elements as described in
SKILL.mdexamples. - Boundary markers: The skill does not define specific text delimiters but relies on structured JSON formatting to separate instructions from data.
- Capability inventory: The agent has the ability to execute shell commands and compile code via the
unity-cliandcargotoolchains. - Sanitization: The
references/runtime-checklist.mdfile contains a security best practice instruction to "Keep JSON payloads quoted as a single shell argument," which helps mitigate command injection risks when processing user-supplied data.
Audit Metadata